Search code examples
asp.net-coresignalrsignalr-hubasp.net-core-signalr

Does SignalR client send the authentication cookie for each hub request


I'm using signalr core and am expect to be sending and receiving messages with the client frequently over mobile, so I've been trimming off the fat to minimize my message sizes. One thing I've simply been curious about is, when making requests from a hub that requires authentication, does every request sent to the hub also sends it's asp.net core authentication cookie, or does the client only send the cookie once when they initiate their connection to the hub and then all subsequent requests no longer need a cookie?


Solution

  • does every request sent to the hub also sends it's asp.net core authentication cookie, or does the client only send the cookie once when they initiate their connection to the hub and then all subsequent requests no longer need a cookie?

    The cookies would be sent with the POST [endpoint-base]/negotiate request that is used to establish a connection between the client and the server, like below.

    enter image description here

    If a connection is established and the WebSockets transport is used, exchanging messages between server and client would be on WebSockets protocol.

    If WebSockets is not available, and Long Polling transport is used, while client communicates with hub, cookies are sent with each request.

    Besides, as mentioned in this doc: cookie authentication isn't recommended unless the app only needs to authenticate users from the browser client.